Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

China PIPL

In force China · In force Nov 1, 2021 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectNov 1, 2021 · 5 years ago · Source
PIPL takes effectAll PIPL obligations (legal bases, consent, cross-border rules, data subject rights) apply (Art. 74).

Summaries for reference, not legal advice. Check the official text.

What it does

China's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.

Who it applies to
Any personal information processor handling PI of natural persons in China, including offshore processors that target or analyze people in China (must appoint a local representative). CII operators and processors reaching CAC-set volumes must store PI in China (Art. 40).
Penalties
Ordinary violations: rectification, confiscation of illegal gains, fines up to RMB 1 million (individuals responsible RMB 10,000-100,000). Serious violations: fines up to RMB 50 million or 5% of prior-year turnover, suspension of business or license revocation; responsible individuals RMB 100,000-1 million (Art. 66).
Enforced by
Cyberspace Administration of China (CAC) and other departments with PI protection duties at county level and above
Official name
Personal Information Protection Law of the People's Republic of China
Citation
Order of the President of the PRC No. 91 (adopted by the 13th NPC Standing Committee, 30th session)
Topics
Privacy, Data residency, Biometrics, Children
Verified 2026-09-22 gov.cn
Research notes

Implementing rules layered on PIPL: Network Data Security Management Regulations (2025-01-01), PI Compliance Audit Measures (2025-05-01), cross-border data flow provisions (2024-03-22). The 2025 Cybersecurity Law amendment adds an express duty for network operators to follow PIPL when processing PI. Reports indicate CAC/SAMR measures on PI export certification took effect 2026-01-01; not verified against the official text here.

Related

AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
Questions about China PIPL
What are the China PIPL compliance deadlines?
Nov 1, 2021: PIPL takes effect.
When does China PIPL take effect?
China PIPL took effect on Nov 1, 2021.
Who does China PIPL apply to?
Any personal information processor handling PI of natural persons in China, including offshore processors that target or analyze people in China (must appoint a local representative). CII operators and processors reaching CAC-set volumes must store PI in China (Art. 40).
What are the penalties under China PIPL?
Ordinary violations: rectification, confiscation of illegal gains, fines up to RMB 1 million (individuals responsible RMB 10,000-100,000). Serious violations: fines up to RMB 50 million or 5% of prior-year turnover, suspension of business or license revocation; responsible individuals RMB 100,000-1 million (Art. 66).